Works with · Qodo
Does a Qodo or PR-Agent review count for SOC 2?
No. Qodo Merge and the open-source PR-Agent post rules-driven findings from bot accounts. They are not an approval by a qualified person other than the author. PSCO reads their findings and adds that person.
How Qodo reviews
Qodo (formerly Codium) reviews pull requests against configurable rules and best practices, posting a review summary, inline findings and suggested improvements. PR-Agent is the open-source version with the same commands.
What it cannot do
Qodo cannot be the independent human approver an auditor is looking for. SOC 2 CC8.1, ISO 27001 A.5.3, PCI DSS 6.2.3.1 and SOX program-change controls all assume a qualified person other than the author approved the change and understood it. A bot account posting "Approve" is a review record, not an accountable person, and as of mid-2026 no auditor reports accepting it as standard practice.
How PSCO reads its output
Qodo and PR-Agent findings are parsed into the Officer’s packet by path and line. Rule-based findings map well to the model’s forbidden patterns, so the Officer sees which of your rules the AI already checked.
Two-step setup
Keep Qodo.
Keep Qodo Merge or PR-Agent running.
Add PSCO.
Install the PSCO GitHub App, select the repos in scope, and require psco/approved and one approval from @psco-officers.
The shared-model tip
Point it at the same model the Officer uses.
Point Qodo at the same rulebook the Officer uses. Add the model’s rules to Qodo’s best-practices file or PR-Agent’s configuration, or reference psco.model.yaml from there. Keep the sensitive paths, required checks and forbidden patterns identical in both places so the robot and the human check the same rules, and so the Officer's packet shows the AI's findings next to the clause they map to.
frameworks: [soc2, iso27001] sensitive_paths: auth/**: deep infra/**: deep required_checks: [ci, tests, sast, secrets] forbidden: [hardcoded_secret, tls_verify_off]
Other reviewers
Claude Code · Codex · GitHub Copilot · Cursor Bugbot · CodeRabbit · Greptile · Graphite Diamond · Macroscope · Devin Review · Ellipsis · Sourcery · Bito AI Code Review Agent · CodeAnt AI · repowise · Gemini Code Assist · Amazon Q Developer · Augment Code · Snyk · Semgrep · Dependabot · Renovate · All
Keep Qodo. Add the human who signs.
Connect GitHub and PSCO detects the reviewers already on your repos. Your price comes from your real PR history.